Object Keys Transform

Protection ID: transformObjectKeys

Object Keys Transform is an advanced obfuscation technique that transforms property names in JavaScript objects into a protected format. This makes it significantly harder for attackers to understand the structure and purpose of objects in your code, adding an important layer of security.

This protection is available in all editions of ByteHide Shield.

How It Works

Object Keys Transform works by replacing plain object keys with expressions that evaluate to the original key names at runtime. Instead of directly using property names like object.property, the protection transforms them into a harder-to-read format such as object["p" + "r" + "op" + "erty"] or uses string array references for even stronger obfuscation.

This transformation obscures the structure of objects in your code, making it more difficult for someone to understand their properties and relationships. The technique is particularly effective for hiding object property names that might reveal functionality or business logic.

Parameters

• Enabled boolean : Enables the Object Keys Transform protection. false by default

Configuration Examples

Basic Configuration (shield.config.json)

{
  "transformObjectKeys": true
}

Combined with String Array Protection

{
  "transformObjectKeys": true,
  "stringArray": true,
  "stringArrayThreshold": 0.8
}

Build Tool Integration (Webpack)

// webpack.config.js
const ByteHideShieldPlugin = require('@bytehide/webpack-shield');

module.exports = {
  // ... other webpack config
  plugins: [
    new ByteHideShieldPlugin({
      projectToken: 'your-project-token',
      config: {
        transformObjectKeys: true
      }
    })
  ]
}

Code Transformation Example

Original Code

function createUser(data) {
  const user = {
    id: generateId(),
    username: data.username,
    email: data.email,
    profile: {
      firstName: data.firstName,
      lastName: data.lastName,
      dateJoined: new Date()
    },
    settings: {
      theme: 'default',
      notifications: true,
      privacyLevel: 'standard'
    }
  };
  
  return user;
}

Transformed Code (with Object Keys Transform)

function createUser(data) {
  const user = {};
  user["id"] = generateId();
  user["user" + "name"] = data["user" + "name"];
  user["em" + "ail"] = data["em" + "ail"];
  
  user["pro" + "file"] = {};
  user["pro" + "file"]["first" + "Name"] = data["first" + "Name"];
  user["pro" + "file"]["last" + "Name"] = data["last" + "Name"];
  user["pro" + "file"]["date" + "Joined"] = new Date();
  
  user["set" + "tings"] = {};
  user["set" + "tings"]["the" + "me"] = "default";
  user["set" + "tings"]["notifica" + "tions"] = true;
  user["set" + "tings"]["privacy" + "Level"] = "standard";
  
  return user;
}

Transformed Code (with Object Keys Transform and String Array)

const _0x3f7b = [
    'profile',
    'firstName',
    'lastName',
    'dateJoined',
    'settings',
    'theme',
    'default',
    'notifications',
    'privacyLevel',
    'standard',
    'id',
    'username',
    'email'
];

function _0x28ac(_0x5b4f12, _0x48c71c) {
    return _0x28ac = function(_0x3a7ef5, _0x28acb0) {
        _0x3a7ef5 = _0x3a7ef5 - 0x12d;
        let _0x21e88e = _0x3f7b[_0x3a7ef5];
        return _0x21e88e;
    }, _0x28ac(_0x5b4f12, _0x48c71c);
}

const _0x481df3 = _0x28ac;

function createUser(data) {
  const _0x48c71c = _0x28ac;
  const user = {};
  
  user[_0x48c71c(0x137)] = generateId();
  user[_0x48c71c(0x138)] = data[_0x48c71c(0x138)];
  user[_0x48c71c(0x139)] = data[_0x48c71c(0x139)];
  
  user[_0x48c71c(0x12d)] = {};
  user[_0x48c71c(0x12d)][_0x48c71c(0x12e)] = data[_0x48c71c(0x12e)];
  user[_0x48c71c(0x12d)][_0x48c71c(0x12f)] = data[_0x48c71c(0x12f)];
  user[_0x48c71c(0x12d)][_0x48c71c(0x130)] = new Date();
  
  user[_0x48c71c(0x131)] = {};
  user[_0x48c71c(0x131)][_0x48c71c(0x132)] = _0x48c71c(0x133);
  user[_0x48c71c(0x131)][_0x48c71c(0x134)] = !![];
  user[_0x48c71c(0x131)][_0x48c71c(0x135)] = _0x48c71c(0x136);
  
  return user;
}

When to Use

Object Keys Transform is particularly valuable in these scenarios:

• Configuration objects: Hide the structure of configuration objects that might reveal functionality
• API responses: Obfuscate the handling of API response objects
• User data processing: Protect object operations dealing with sensitive user data
• Business logic objects: Hide object properties that reveal business rules or algorithms

For optimal results:

1. Use in combination with String Array protection
2. Apply to code that handles complex object structures
3. Consider that accessing transformed properties may have a slight performance impact
4. Be aware that this transformation increases code size

Compatibility Notes

Object Keys Transform has the following compatibility considerations:

• Browser compatibility: Works in all modern browsers
• Performance: Slight performance overhead when accessing transformed properties
• Dynamic property access: Compatible with dynamic property access patterns
• Library interoperability: Works well with most libraries, but test thoroughly when using with libraries that rely on specific object property patterns

Related Protections

For maximum security, combine Object Keys Transform with:

• String Array
• Split Strings
• Control Flow Flattening